[Harald]

So, Morning All.

Was just chilling drinking my coffee, till I received a random-ass PM from some user. This user is claiming I asked for an eBook? Considering, I've never asked for an eBook in my life, I found this very hard to believe, so I had to check his profile which was already looking fishy as it is, so I proceed to run a virus total scan against the sent file, you can see for your self below the results and the PM.

So be cautious dealing with this user, I will update the thread with any more reports like this.

Profile Link:
https://hackforums.net/member.php?action...id=4233147

Virus Total:
https://www.virustotal.com/gui/url/c64bc.../detection

PM Proof:


User Info:
UID: 4233147

Usernames(s)
imsorri1

[rsx]

There's gotta be someone with a VM on here to test this.

I'm willing to be it's a RAT.

[SIM-1729678]

Nice alert. Curious if the file is actually infected.

[Harald]

There's gotta be someone with a VM on here to test this.

I'm willing to be it's a RAT.

I can send you the link, if you want?

[rsx]

I will send you the link if you want?

I don't have that type of stuff or knowledge to test it, I know there was someone on here a while ago who used to test sus files in a VM.

[Harald]

I don't have that type of stuff or knowledge to test it, I know there was someone on here a while ago who used to test sus files in a VM.

If I get some free time, I will set up a VM and debug it.

In the meantime, if anyone wishes to take this task on, just say. I can send you the link.

[rsx]

If I get some free time, I will set up a VM and debug it.

In the meantime, if anyone wishes to take this task on, just say. I can send you the link.

Let us know what you find, his profile is for sure suspicious with an upgrade already with only 3 posts sending random links.

[Harald]

Let us know what you find, his profile is for sure suspicious with an upgrade already with only 3 posts sending random links.

Exactly, The virus scan has picked up a detection as well, which is not normal behaviour for a PDF Document.

[Natas]

Bastille your time to shine buddy enlighten us with your knowledge buddy.

Could be false positive could be a virus I cant really tell and am not gonna test it lmao.
although im going to upload one of my ebooks and see if it shows a false positive or not because im curious
and its pretty sketchy that dude has no posts giving a ebook he had 1 thread but it got deleted and I cant see what it is
so in my opinion it is super sketchy

[Harald]

Bastille your time to shine buddy enlighten us with your knowledge buddy.

Could be false positive could be a virus I cant really tell and am not gonna test it lmao.
although im going to upload one of my ebooks and see if it shows a false positive or not because im curious
and its pretty sketchy that dude has no posts giving a ebook he had 1 thread but it got deleted and I cant see what it is
so in my opinion it is super sketchy

Yes, I should mention somewhere this isn't confirmed a threat. However, giving the following circumstances I'm at least 80% sure this is user is trying his luck to infect unware users that may fall for this.

---

Update; https://hackforums.net/showthread.php?tid=6031692

[Natas]

Also looks like it could be a lost / stolen account

Password Reset in Last Week: Yes
Last Password Change: Yesterday

[cryp]

Give me the link, will test it.

---

Nice alert. Curious if the file is actually infected.

Let us know what you find, his profile is for sure suspicious with an upgrade already with only 3 posts sending random links.

Yes, I should mention somewhere this isn't confirmed a threat. However, giving the following circumstances I'm at least 80% sure this is user is trying his luck to infect unware users that may fall for this.

---

Update; https://hackforums.net/showthread.php?tid=6031692

Also looks like it could be a lost / stolen account

Password Reset in Last Week: Yes
Last Password Change: Yesterday

I believe this file isn't actually a virus.

Now, I would NOT open this on a PC or disregard it because of my following statement.

But you can see: https://hackforums.net/showthread.php?tid=6031640

He responded to this, I'm 75% sure he's spreading a referral link rather than a virus.

[Bass_Reeves]

Hahah, literally same thing just happened to me. Morning coffee, and everything.

Thought to myself..."not today Satan".

👹

[Dracaryzs]

It;s not a RAT. It's a JavaScript Tamper Monkey script to change Bitcoin receiving address.

[Bastille]

Natas Thanks for mentioning, old my beer

Harald Can you send me the link ?

By the way, should we move this thread to the White hat section admins ?

Edit : Get the link into the Virus Total link